PT-2020-13680 · Vmware · Harbor

Hidde Smit · Published 2020-09-29 · Updated 2024-08-21 · CVE-2020-13794

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Harbor versions 1.9.* through 2.0.*

Description The issue allows exposure of sensitive information to an unauthorized actor. Authenticated users can exploit an enumeration vulnerability in Harbor. The vulnerability is present in the "/users" API endpoint, which is supposed to be restricted to administrators. This restriction can be bypassed, and information can be obtained via the "search" functionality. Non-administrator users can list all usernames and user IDs by sending a GET request to "/api/users/search" with the parameter username and value .

Recommendations For Harbor versions 1.9.* through 2.0.*, update to either version 2.1.0 or 2.0.3 to fix this issue immediately. As a temporary workaround is not available, updating to the patched version is the recommended course of action.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-HARBOR-2020-13794

CVE-2020-13794

GHSA-Q9P8-33WC-H432

GO-2022-0865

Affected Products

Harbor

References · 11

• 🔥 https://github.com/goharbor/harbor/security/advisories/GHSA-q9p8-33wc-h432 · Exploit
• 🔥 https://cybereagle.io/blog/cve-2020-13794 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13794 · Security Note
• https://osv.dev/vulnerability/GO-2022-0865 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-harbor-2020-13794 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13794 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q9p8-33wc-h432 · Vendor Advisory
• https://github.com/goharbor/harbor/releases · Note
• https://github.com/goharbor/harbor · Note
• https://github.com/goharbor/harbor/releases/tag/v2.1.0 · Note
• https://github.com/goharbor/harbor/releases/tag/v2.0.3 · Note